Django Memory Consumption Vulnerability in django
Summary
CVE-2024-41989: Django memory consumption vulnerability. Affects django across 2 version ranges.
>= 4.2, < 4.2.15
>= 5.0, < 5.0.8
Fixed in 4.2.15 or 5.0.8, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2024-41989 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Django is a popular Python web framework known for its simplicity and versatility. It provides developers with a robust set of tools and features to build web applications efficiently. However, a vulnerability has been discovered in Django versions 5.0 before 5.0.8 and 4.2 before 4.2.15. This vulnerability affects the floatformat template filter, which consumes a significant amount of memory when given a string representation of a number in scientific notation with a large exponent.
Vulnerability Detail
The Django memory consumption vulnerability arises from a flaw in the floatformat template filter. When this filter encounters a string representation of a number in scientific notation with a large exponent, it consumes excessive memory. This can lead to memory exhaustion and potentially impact the stability and performance of Django applications. The vulnerability has a CVSSv3 score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2, < 4.2.154.2.15pip install --upgrade "django==4.2.15" -
>= 5.0, < 5.0.85.0.8pip install --upgrade "django==5.0.8"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can avoid using the floatformat template filter with string representations of numbers in scientific notation with large exponents. Instead, they can convert the numbers to a different format or use alternative methods to achieve the desired output.
Conclusion
The Django memory consumption vulnerability in versions 5.0 before 5.0.8 and 4.2 before 4.2.15 can result in excessive memory usage when using the floatformat template filter with certain number representations. Upgrading to the recommended versions or applying the provided patch is crucial to mitigate the vulnerability and ensure the stability and performance of Django applications.
See every vulnerability recorded for django →
FAQ
Django is a Python web framework that simplifies the development of web applications by providing a high-level, reusable, and modular structure.
The vulnerability can cause excessive memory consumption, leading to memory exhaustion and potential performance issues in Django applications.
The CVSSv3 score of this vulnerability is 5.3, indicating a moderate severity level.
To fix the vulnerability, upgrade Django to version 5.0.8 or apply the provided patch in versions 4.2.15.
As a temporary workaround, avoid using the floatformat template filter with string representations of numbers in scientific notation with large exponents.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
